Is this auto-rate switching issue something that needs to be further
reverse-engineered or is it just something in the kernel driver (or
something wonky in my case)?

Doesn't even need reverse-engineering. We do it in software; we just
need to implement that part of the low-level 802.11 stack (which is
_also_ being developed alongside the bcm43xx hardware driver).
--
dwmw2